Hetzner Object Storage Client: Connect, Mount, Fix Errors

Hetzner Object Storage is S3-compatible, cheap and in the EU, which is why it turns up in European projects long before anyone has picked a desktop tool for it. This page covers the settings a client needs, the limits that shape how you work, and the errors that come from the places where Hetzner is not Amazon. Everything was read on docs.hetzner.com and hetzner.com in September 2026. For the wider field of tools, see the S3 GUI client overview.

Three endpoints, and the addressing style that goes with them

There are three locations, each with its own endpoint hostname:

Objects are published at https://<bucket-name>.<location>.your-objectstorage.com/<file-name> — the bucket is a subdomain, not a path segment. That is virtual-hosted-style addressing, and Hetzner's own tool examples match it: the MinIO client configuration sets --path 'off', and the AWS CLI page notes addressing_style = virtual for presigned URLs. So when a client offers a "path-style" or "force path style" checkbox, leave it off for Hetzner. This is the opposite of MinIO, where path-style is usually required — see the MinIO client page for that side of it.

mc alias set hetzner https://fsn1.your-objectstorage.com <ACCESS_KEY> <SECRET_KEY> --api 's3v4' --path 'off'
mc ls hetzner
aws s3 ls --endpoint-url https://fsn1.your-objectstorage.com

Hetzner documents mc, s3cmd, s5cmd, rclone and the AWS CLI, and its FAQ states plainly: "Yes you can manage your Buckets via AWS CLI und AWS SDKs." Authentication is AWS Signature version 4, with one storage class, Standard.

Getting the keys out of the Cloud Console

Credentials are created per project, not per account. In the Hetzner Console, open the project, then Security in the left menu, then S3 Credentials in the upper menu, then Generate credentials, give them a description, and copy both values.

Copy the secret immediately. The documentation is blunt about it: "It is not possible to view the secret key again once the window has been closed!" And because keys are scoped to a project, "It is not possible to share S3 credentials across multiple projects unless you set up appropriate bucket policies" — so a client that needs to see buckets in two projects needs two connections, or a bucket policy that grants one key access to the other project's bucket.

The limits that change how you work

Two of those deserve a sentence each. The 64 kB floor means a bucket full of thumbnails or JSON fragments is billed as if every object were 64 kB, so a client that uploads a million 2 kB files is buying 64 GB. And billing is hourly on existence, not on bytes: "You are charged for every hour you have at least one active Bucket, even if it's empty." An empty test bucket left behind for a month is a full month of base price.

The 5 GB single-PUT ceiling is the one that decides tooling. Anything larger has to go through multipart upload, which every serious client does automatically — but it is why a hand-rolled script that PUTs a 20 GB video fails while a GUI client succeeds.

Bucket names are stricter than Amazon's

Because the bucket is a DNS label, the naming rules are tighter than S3's, and they matter before you type a name you cannot change. Hetzner allows "the alphabet (a-z), digits (0-9), minus sign (-)" with "No period (.), No blank or space characters, No upper case characters"; the first character must be a letter or digit, the last must not be a minus sign, the length must be 3 to 63 characters, and the name must be valid per RFC 1123 and not formatted as an IP address. Banning the period is stricter than Amazon, which permits dots at the cost of TLS wildcard problems. And: "it is NOT possible to change the name once the Bucket is created."

What Hetzner does not implement

The compatibility statement is honest: "Our Object Storage API offers basic compatibility with the standard Amazon S3 actions and data types." Versioning, Object Lock with legal hold and retention, CORS policies, lifecycle policies and SSE-C encryption all have their own how-to pages. The supported-actions list also names what is missing, and some of it will surprise people migrating from S3: bucket Website, Notifications, Accelerate, Analytics, Intelligent Tiering, Inventory, Logging, Metrics, Ownership Controls, Replication, Tagging and Request-Payment are all listed as not supported, as are object Restore, Select Content, Torrent and GetObjectAttributes. Bucket creation accepts "Limited headers and XML body elements only", encryption is SSE-C only, and CopyObject carries the note "Source and destination must be identical".

Custom domains are the other gap: "Currently, it is not possible to assign a custom domain name to a Bucket." Hetzner documents an S3 Proxy as a workaround and warns that it "makes the Bucket data publicly accessible via your own domain even if the Bucket visibility is set to private" — which is a good reason to put basic authentication in front of it, or to hand out presigned links instead.

Connecting from a desktop client

Hetzner documents two graphical clients. Cyberduck is the smoothest, because a Hetzner Object Storage profile ships in Cyberduck's own preferences: enable it, pick the location, and the server and URL are filled in for you — you supply only the access key and secret key. WinSCP has its own Hetzner page too.

Anything else needs four values: the endpoint URL from the table above, the matching region string, the access key and the secret key, with path-style addressing left off. In AnyStorage 0.2.25 that is the S3 connection type — a custom endpoint URL, a custom region and an explicit path-style toggle are all editable fields, so Hetzner needs no special build. It runs on macOS 11 or newer, Windows 10 or newer and Ubuntu 20.04 or newer, stores credentials encrypted on the machine, and creates no account. The free tier allows two storage connections and permits commercial use; more than 20 connection types, search, preview and bulk operations are Pro. Platform detail lives on the Windows and Linux pages.

Mounting a bucket as a drive

Hetzner publishes no mount tool, so the two routes are the usual ones: rclone mount, which needs FUSE on macOS and Linux or WinFsp on Windows, or a client that serves the bucket back over a protocol your system already speaks. AnyStorage takes the second route — a WebDAV server on http://127.0.0.1:3211 that Finder, File Explorer, GNOME Files, Dolphin or davfs2 can mount, with no kernel driver anywhere, and each connected storage as a folder under one mount point. The free tier serves that mount read-only. Step by step: map an S3 bucket as a network drive; the FUSE comparison is on rclone mount alternatives.

Errors that are really configuration

• `SignatureDoesNotMatch` usually means the region string and the endpoint disagree, or the secret was truncated on its way out of the Console. The MinIO SignatureDoesNotMatch page walks the same failure end to end.
• `NoSuchBucket` on a name that exists is often a path-style client talking to a virtual-hosted endpoint, or a key from the wrong project.
• A browser upload blocked by CORS is a bucket policy, not a client bug; the mechanics match Amazon's and are on S3 CORS error.
• `EntityTooLarge` is the 5 GB single-PUT limit. Use a client that does multipart upload.

Questions